24cc9bbc3706d63f04b2dfaa79f60118096c306bad5834eff7cbc5634d1f0d5c

Analysis

max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_b10d5213011ce3edb1d60982b2af26a9_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Size 2.8MB
Sample260509-tk987sat2w
SHA256 24cc9bbc3706d63f04b2dfaa79f60118096c306bad5834eff7cbc5634d1f0d5c
MD5 b10d5213011ce3edb1d60982b2af26a9
SHA1 49da565d9e494b328f1856fc0df6a3f1133261c4
SHA512 18571187b90d72f3a73780a62dbbd62b0e83eb891725163aa81b7925d4d776ca812c48e66d2760a4855648c4f961bda3195041a616b8940dcfc3d2e1ed665790
SSDEEP 49152:di/+9r3Uea8ezjEKkCDs/m1JlIn/EUrQxfj+vo+kUv/acPTXi9Uo0/ab3W4A:M/6E38EYKkY1Jli/3rQp+QiPP+Sm
TLSH
T1BBD522B76E9760ABE4E647F68BC441428735FC3593129DFFA3493A6A0D331819FA1321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence privilege_escalation

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b3c3-2.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b3c3-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b3c3-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 3 IoCs

pid	Process
4956	authmicrosoft.exe
1104	vi-agent.exe
876	vi-agent.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Roaming\\VisualIllusion\\vi-agent.exe"	vi-agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Local\\IpotaLocal\\jxc637fc99884c93da4\\authmicrosoft.exe"	authmicrosoft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Roaming\\VisualIllusion\\vi-agent.exe"	vi-agent.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ifconfig.me
19	api.ipify.org
10	api.ipify.org
10	ifconfig.me
16	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	authmicrosoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	authmicrosoft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vi-agent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vi-agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1592	WMIC.exe
Token: SeSecurityPrivilege	1592	WMIC.exe
Token: SeTakeOwnershipPrivilege	1592	WMIC.exe
Token: SeLoadDriverPrivilege	1592	WMIC.exe
Token: SeSystemProfilePrivilege	1592	WMIC.exe
Token: SeSystemtimePrivilege	1592	WMIC.exe
Token: SeProfSingleProcessPrivilege	1592	WMIC.exe
Token: SeIncBasePriorityPrivilege	1592	WMIC.exe
Token: SeCreatePagefilePrivilege	1592	WMIC.exe
Token: SeBackupPrivilege	1592	WMIC.exe
Token: SeRestorePrivilege	1592	WMIC.exe
Token: SeShutdownPrivilege	1592	WMIC.exe
Token: SeDebugPrivilege	1592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1592	WMIC.exe
Token: SeRemoteShutdownPrivilege	1592	WMIC.exe
Token: SeUndockPrivilege	1592	WMIC.exe
Token: SeManageVolumePrivilege	1592	WMIC.exe
Token: 33	1592	WMIC.exe
Token: 34	1592	WMIC.exe
Token: 35	1592	WMIC.exe
Token: 36	1592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1592	WMIC.exe
Token: SeSecurityPrivilege	1592	WMIC.exe
Token: SeTakeOwnershipPrivilege	1592	WMIC.exe
Token: SeLoadDriverPrivilege	1592	WMIC.exe
Token: SeSystemProfilePrivilege	1592	WMIC.exe
Token: SeSystemtimePrivilege	1592	WMIC.exe
Token: SeProfSingleProcessPrivilege	1592	WMIC.exe
Token: SeIncBasePriorityPrivilege	1592	WMIC.exe
Token: SeCreatePagefilePrivilege	1592	WMIC.exe
Token: SeBackupPrivilege	1592	WMIC.exe
Token: SeRestorePrivilege	1592	WMIC.exe
Token: SeShutdownPrivilege	1592	WMIC.exe
Token: SeDebugPrivilege	1592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1592	WMIC.exe
Token: SeRemoteShutdownPrivilege	1592	WMIC.exe
Token: SeUndockPrivilege	1592	WMIC.exe
Token: SeManageVolumePrivilege	1592	WMIC.exe
Token: 33	1592	WMIC.exe
Token: 34	1592	WMIC.exe
Token: 35	1592	WMIC.exe
Token: 36	1592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4248	WMIC.exe
Token: SeSecurityPrivilege	4248	WMIC.exe
Token: SeTakeOwnershipPrivilege	4248	WMIC.exe
Token: SeLoadDriverPrivilege	4248	WMIC.exe
Token: SeSystemProfilePrivilege	4248	WMIC.exe
Token: SeSystemtimePrivilege	4248	WMIC.exe
Token: SeProfSingleProcessPrivilege	4248	WMIC.exe
Token: SeIncBasePriorityPrivilege	4248	WMIC.exe
Token: SeCreatePagefilePrivilege	4248	WMIC.exe
Token: SeBackupPrivilege	4248	WMIC.exe
Token: SeRestorePrivilege	4248	WMIC.exe
Token: SeShutdownPrivilege	4248	WMIC.exe
Token: SeDebugPrivilege	4248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4248	WMIC.exe
Token: SeRemoteShutdownPrivilege	4248	WMIC.exe
Token: SeUndockPrivilege	4248	WMIC.exe
Token: SeManageVolumePrivilege	4248	WMIC.exe
Token: 33	4248	WMIC.exe
Token: 34	4248	WMIC.exe
Token: 35	4248	WMIC.exe
Token: 36	4248	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4248	WMIC.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4956	5060	2026-05-09_b10d5213011ce3edb1d60982b2af26a9_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	78
PID 4956 wrote to memory of 1680	4956	authmicrosoft.exe	79
PID 1680 wrote to memory of 1592	1680	cmd.exe	81
PID 4956 wrote to memory of 2944	4956	authmicrosoft.exe	83
PID 2944 wrote to memory of 4248	2944	cmd.exe	85
PID 4956 wrote to memory of 2040	4956	authmicrosoft.exe	86
PID 2040 wrote to memory of 4080	2040	cmd.exe	88
PID 4956 wrote to memory of 4000	4956	authmicrosoft.exe	89
PID 4000 wrote to memory of 2184	4000	cmd.exe	91
PID 4956 wrote to memory of 1104	4956	authmicrosoft.exe	92
PID 1104 wrote to memory of 3216	1104	vi-agent.exe	93
PID 3216 wrote to memory of 5948	3216	cmd.exe	95
PID 1104 wrote to memory of 4004	1104	vi-agent.exe	96
PID 4004 wrote to memory of 3832	4004	cmd.exe	98
PID 1104 wrote to memory of 3892	1104	vi-agent.exe	99
PID 3892 wrote to memory of 1928	3892	cmd.exe	101
PID 1104 wrote to memory of 5244	1104	vi-agent.exe	102
PID 5244 wrote to memory of 1696	5244	cmd.exe	104
PID 876 wrote to memory of 2080	876	vi-agent.exe	108
PID 2080 wrote to memory of 3044	2080	cmd.exe	110
PID 876 wrote to memory of 4396	876	vi-agent.exe	111
PID 4396 wrote to memory of 784	4396	cmd.exe	113
PID 876 wrote to memory of 1548	876	vi-agent.exe	114
PID 1548 wrote to memory of 5676	1548	cmd.exe	116
PID 876 wrote to memory of 1324	876	vi-agent.exe	117
PID 1324 wrote to memory of 4544	1324	cmd.exe	119
PID 1104 wrote to memory of 3856	1104	vi-agent.exe	120
PID 1104 wrote to memory of 2520	1104	vi-agent.exe	122
PID 876 wrote to memory of 6080	876	vi-agent.exe	124
PID 876 wrote to memory of 4976	876	vi-agent.exe	126
PID 876 wrote to memory of 5400	876	vi-agent.exe	128
PID 876 wrote to memory of 1732	876	vi-agent.exe	130
PID 1104 wrote to memory of 4352	1104	vi-agent.exe	132
PID 1104 wrote to memory of 216	1104	vi-agent.exe	134
PID 1104 wrote to memory of 5360	1104	vi-agent.exe	136
PID 1104 wrote to memory of 2596	1104	vi-agent.exe	138
PID 876 wrote to memory of 5444	876	vi-agent.exe	140
PID 876 wrote to memory of 6056	876	vi-agent.exe	142
PID 876 wrote to memory of 2624	876	vi-agent.exe	144
PID 876 wrote to memory of 432	876	vi-agent.exe	146
PID 1104 wrote to memory of 4852	1104	vi-agent.exe	148
PID 1104 wrote to memory of 3024	1104	vi-agent.exe	150
PID 1104 wrote to memory of 4236	1104	vi-agent.exe	152
PID 1104 wrote to memory of 5892	1104	vi-agent.exe	154
PID 876 wrote to memory of 3224	876	vi-agent.exe	156
PID 876 wrote to memory of 2844	876	vi-agent.exe	158
PID 876 wrote to memory of 2372	876	vi-agent.exe	160
PID 876 wrote to memory of 1684	876	vi-agent.exe	162
PID 1104 wrote to memory of 5136	1104	vi-agent.exe	164
PID 1104 wrote to memory of 944	1104	vi-agent.exe	166
PID 1104 wrote to memory of 552	1104	vi-agent.exe	168
PID 1104 wrote to memory of 6104	1104	vi-agent.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-09_b10d5213011ce3edb1d60982b2af26a9_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_b10d5213011ce3edb1d60982b2af26a9_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\IpotaLocal\jxc637fc99884c93da4\authmicrosoft.exe
  "C:\Users\Admin\AppData\Local\IpotaLocal\jxc637fc99884c93da4\authmicrosoft.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1592
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic baseboard get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4248
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:4080
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic baseboard get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:2184
- - C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
    "C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber /value
        5⤵
        
        PID:5948
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C wmic baseboard get serialnumber /value 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber /value
        5⤵
        
        PID:3832
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber /value
        5⤵
        
        PID:1928
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C wmic baseboard get serialnumber /value 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber /value
        5⤵
        
        PID:1696
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3856
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2520
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4352
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:216
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5360
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2596
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4852
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3024
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4236
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5892
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5136
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:944
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:552
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:6104

C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:3044
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:784
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:5676
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:4544
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6080
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4976
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5400
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1732
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5444
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6056
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2624
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:432
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3224
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2844
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2372
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

authmicrosoft.exe

Path C:\Users\Admin\AppData\Local\IpotaLocal\jxc637fc99884c93da4\authmicrosoft.exe
Size 2.6MB
SHA256 795fccb5c47619cd2431e49428b1242da66f481944729c2368be155d96e160e2
MD5 c1477bde46637d6db7ece5afc694a894
SHA1 ef8cb1ae53590a6ef1d17e87e8f39201ff630cf8
SHA512 fccccf06d02796fc42664aaf085aae8ad0309261dff60b442ebb7c1340f191b50f36660303425990f5f0f874604b61cb86c62be07ff10684c25376d22d527f89
SSDEEP 49152:jIZn2HpYAlK+7BV43Xm1OldI/Yq45ckGEvU:Sn2uqzpSn9U
TLSH
T15BD59E07A36901EDD067C2B8CE565A03F7B178461730BBDB16E086562FA3BE55E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/876-11-0x000001D951F40000-0x000001D951F4C000-memory.dmp

Download

memory/876-25-0x000001D951FB0000-0x000001D951FC2000-memory.dmp

Download

memory/1104-10-0x0000020DC97A0000-0x0000020DC97AC000-memory.dmp

Download

memory/1104-23-0x0000020DCB1C0000-0x0000020DCB1D2000-memory.dmp

Download

memory/4956-7-0x000001A2CCD00000-0x000001A2CCD0C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads